The appliance gave up every credential it held

BeyondTrust has told customers to patch a critical flaw in Remote Support, its enterprise support product, that has been exploited in zero-day attacks since late August. The vulnerability is tracked as CVE-2026-102764, an authentication bypass that lets an unprivileged remote attacker perform file operations on an unpatched appliance, and it affects Remote Support 26.2.3 and earlier.

The company patched Remote Support and Privileged Remote Access for all SaaS customers on 8 October. Self-hosted installations must be patched by hand unless automatic updates are enabled, and that is where the remaining exposure sits. Shadowserver tracks more than 1,400 BeyondTrust remote support instances reachable from the internet, without saying how many are already secured or are honeypots.

BeyondTrust attributes the attacks to a suspected China-nexus espionage actor, tracked by Mandiant and Google Threat Intelligence Group as Armory Castle, formerly UNC5221, and by CrowdStrike as Warp Panda. According to Mandiant, which spotted the initial attacks, the operators used the flaw for access, escalated to root by enabling Set User ID permissions, deployed a web shell called Sawfly and a tunneler called Bareclaw, wiped logs, and moved laterally by opening remote sessions on downstream systems with compromised administrator credentials.

After establishing a foothold through the web shell, the actor elevated from the web service account to root-level control of the appliance host. This gave them access to every credential the appliance stored or brokered and the ability to modify files that survive reboot and configuration reset.

The instruction follows from that: an appliance that was internet-reachable on a vulnerable version during the exploitation window should be treated as potentially compromised until reviewed. The group has form. It has targeted zero-days in network edge appliances since at least October 2023, including Citrix NetScaler and Ivanti Connect Secure, and Volexity reported in January 2024 that it had backdoored more than 2,100 Ivanti appliances with the GiftedVisitor web shell.